Breaking the Supply Chain: How the Fall of TeamPCP Exposed the New Face of Cybercrime

Executive Overview

In a landmark coordinated international law enforcement sweep, Australian authorities—working alongside the Federal Bureau of Investigation (FBI) and Western Australia Police Force—have arrested two men suspected of being central figures in TeamPCP, a prolific cybercrime and data extortion collective. The syndicate is blamed for masterminding what security experts call the longest-running and most destructive software supply chain attack spree in history.

The two suspects, aged 21 and 23 and hailing from Western Australia, were taken into custody during morning raids in Perth. They face a combined 14 cybercrime offenses relating to the creation and deployment of malicious open-source software designed to rob and extort thousands of global enterprises. Court filings and subsequent news reports have identified the 21-year-old suspect as Ruben Ian Thomson of Cottesloe, a beachside suburb of Perth, and the 23-year-old as Michael Gaebler. Thomson—who operated under aliases including "Ellis," "EllisD25," "BulkDMT," and the TeamPCP spokesperson handle "@pcpcats"—served as a principal leader and coordinator for the loose-knit hacker coalition.

TeamPCP exploded onto the global threat landscape in late 2025, altering the digital trust model by embedding malicious code into hundreds of trusted open-source libraries. Using a self-propagating worm dubbed Shai-Hulud, the group systematically harvested credentials from developer repositories on GitHub, NPM, and AI infrastructure gateways. Their operations compromised thousands of organizations worldwide, including tech giants, automotive titans, and pharmaceutical multinationals.

While the arrests mark a major victory for international cybersecurity cooperation, the takedown of TeamPCP also unveils a cautionary tale of modern digital extortion: a decentralized fraternity of gifted, albeit reckless, young hackers operating at immense scale while battling severe personal demons, substance addiction, and fatal operational security (OPSEC) failures.

Detailed Chronology: The Rise and Fall of TeamPCP

The Inception and Exploitation Cycle

TeamPCP emerged in late 2025 as a disruptive force within the cybercrime underground. Rather than operating as a traditional, highly disciplined ransomware gang, TeamPCP functioned as a peer community of skilled actors driven by a mixture of financial gain, notoriety, and ideological alignment.

The group’s signature methodology, meticulously documented by journalists and security researchers, was a cyclical exploitation loop targeting software developers:

1. Initial Access: Hackers infiltrated networks where popular open-source coding tools were developed, frequently via phished or stolen credentials on public repositories like GitHub.
2. Payload Injection: They planted malicious code into the targeted utilities.
3. Infection Vector: When unsuspecting developers downloaded these tools, the malware infected their machines, harvesting credentials for other developer tools and code repositories.
4. Expansion: The cycle repeated exponentially, expanding TeamPCP’s collection of breached corporate networks and code repositories.

In March 2026, TeamPCP executed a high-profile supply chain attack targeting artificial intelligence infrastructure by compromising LiteLLM, an open-source AI gateway linking users to over 100 large language models (LLMs). Security firm CloudSEK later revealed that this single breach harvested cloud service keys and administrative secrets from more than 2,500 organizations, including elite global technology companies. By May, the group claimed credit for compromising at least 3,800 code repositories at Microsoft-owned GitHub after an engineer installed a compromised extension.

Gamifying Cybercrime: The Shai-Hulud 3.0 Contest

Seeking to scale their operations further, TeamPCP embraced gamification. In May 2026, the group published the source code for the third iteration of the Shai-Hulud worm online. Simultaneously, they launched a hacking contest on Telegram, offering a minimum prize pool of $1,000 in Monero (XMR) to the participant who could conduct the largest supply chain operation using the worm’s code.

Contestants were scored based on the weekly and monthly download counts of the packages they successfully compromised, directly incentivizing attacks on the most popular code libraries. Security firm Dataminr noted that the $1,000 prize served merely as a "participation trophy," with group leaders assuring participants that finding valuable enterprise access would yield significantly higher payouts. This contest acted as an open recruitment drive, vacuuming up external talent and harvesting illicit access at scale.

The "Cybercats" and the Network of Extortionists

Security analysts from the Google Threat Intelligence Group characterized TeamPCP not as a structured criminal enterprise with a single boss, but rather as an amalgamation of threat actors from multiple disparate gangs who collaborated toward overlapping goals.

The organizational nexus of this community was a Matrix chat server dubbed Cybercats, created earlier in the year by an accomplished security researcher and self-described exploit developer who operates the X (formerly Twitter) handle @kernelstub (George Prepakis). The server acted as a daily watercooler for cybercriminals representing various syndicates.

Key figures in the Cybercats server included:

• Boxturtle (@xpl0itrsturtle): A data breach broker active on Breachforums and Darkforums who trafficked in data stolen from major automotive manufacturers—including BMW, Audi, Honda, Mercedes-Benz, Volvo, and Toyota—as well as corporate assets from Snapchat and SportRadar.
• SeesawSec: The alias behind Fulcrumsec, an extortion syndicate linked to high-profile data theft campaigns against pharmaceutical giant Novo Nordisk, data broker LexisNexis, and Fortune 500 distributor Avnet.
• @pcpcasper (Michael Gaebler): A vocal participant whose Telegram history linked him to the National Socialist Network, an Australian neo-Nazi organization. Gaebler’s digital footprint and shared photos of his cat ultimately placed him in Western Australia, leading to his arrest alongside Thomson.
• T / @pcpcats (Ruben Thomson): The self-described TeamPCP spokesperson and technical mastermind who orchestrated the group’s early operations before stepping back in March 2026.

Supporting Context & Metrics: The Anatomy of an OPSEC Collapse

Despite orchestrating one of the most disruptive software supply chain campaigns in digital history, the core operators of TeamPCP committed catastrophic operational security blunders that effectively handed investigators a roadmap to their front doors.

The Trail of Digital Breadcrumbs

Ruben Thomson utilized a dizzying array of online monikers—including EllisD25/LSD on Darkforums, BulkDMT on Breachstars, Express on Breachforums, and Deadcatx3 on HackerOne. However, investigators were able to stitch these personas together through persistent reuse of instant messaging identifiers (Tox IDs and Session IDs), email addresses, and internet protocol (IP) addresses.

1. The Email Link: Intel 471 established that the handle Express registered on Breachforums using the email address [email protected]. Identity threat protection firm SpyCloud traced this exact email to an account named ChristmasSnow created on Raidforums in 2022, which accessed the platform almost exclusively via Internet Service Providers in Perth, Australia.
2. Passive DNS and Family Footprints: DomainTools passive DNS logs revealed that a Perth IP address (211.27.196.111) had served for years as a private file server for the Thomson family. Open-source intelligence tied this address to Ian Thomson (a Cottesloe dentist originally from South Africa), his wife Cindy, and their sons Joshua and Ruben.
3. The Alias Mismatch: Ruben Thomson maintained a legitimate professional profile as a full-stack web developer and server administrator on Upwork and Airbnb, where he used the nickname "Ellis." On GitHub and HackerOne, however, he utilized the handle Deadcatx3—a username security firms had already explicitly flagged as a primary alias for TeamPCP.
4. Corporate Irony: In a final display of flawed tradecraft, Thomson incorporated several business entities under Australian corporate registries, including Secure Computing Solutions, Tensor Industries, and an enterprise ironically named OPSEC Express. "OPSEC" is an acronym for operational security; utilizing one’s active cybercriminal handle within a legally registered corporate name represents the absolute antithesis of the discipline.

Official Statements and Legal Proceedings

The Australian Federal Police formally announced the arrests in a joint media release detailing the multi-agency disruption operation involving the AFP, the FBI, and the Western Australia Police Force.

"Two men from Western Australia, aged 21 and 23, have been arrested in connection with a sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses," the AFP stated.

Following their morning arrests, the suspects appeared before the Perth Magistrates Court. Australian Broadcasting Corporation (ABC) news reports confirmed that Ruben Ian Thomson was formally denied bail, while Michael Gaebler’s defense attorney did not seek bail. Both men remain remanded in custody ahead of their next scheduled court appearance on September 18. They face a battery of charges under federal cybercrime legislation carrying significant prison sentences.

Future Outlook: The AI Knowledge Gap and Industry Reform

Security analysts monitoring the fallout of the TeamPCP takedown emphasize that the syndicate represents a terrifying new paradigm in cyber threats.

Charlie Eriksen, a security researcher at Aikido Security, noted that TeamPCP defied traditional threat-actor taxonomies. "They are not a state actor, not quite organized cybercrime, and not purely ideological," Eriksen observed. "Their motivations seem to mix money, disruption, attention, and ideology."

Furthermore, experts warn that the lowering barrier to entry caused by generative artificial intelligence and large language models has accelerated the threat landscape. Historically, a significant knowledge gap existed between reading academic research on an attack vector and operationalizing it into a functional, scalable campaign. Today, LLMs compress that gap, allowing technically adept individuals with limited discipline to execute devastating global attacks.

The Positive Legacy: Fixing the Supply Chain

Ironically, despite the widespread chaos they caused, TeamPCP may have permanently improved the baseline security of the global software ecosystem. Their relentless exploitation of GitHub forced Microsoft and other platform administrators to reckon with systemic vulnerabilities in automated dependency updates.

In response to campaigns like Shai-Hulud, GitHub instituted a mandatory three-day "cooldown" mechanism for Dependabot in late July 2026. This cooling-off period forces automated systems to wait before fetching newly published package updates, granting security tools and open-source maintainers vital breathing room to detect and purge malicious code injections before they propagate downstream. Similar cooldown frameworks have since been adopted across Python, JavaScript, and other major coding ecosystems.

As Eriksen concluded: "TeamPCP’s legacy is that they achieved in the span of a few months what the supply chain security community has been unable to do for years. They managed to wake up Microsoft to the fact that they had become negligent… making them finally act on what we had been asking them to take seriously for a long time."

With its leaders behind bars in Perth, the chapter on TeamPCP is drawing to a close, but the structural reforms forced by their disruptive campaign will permanently reshape how developers build, share, and trust open-source software.